Privacy notice

1. Who controls your personal data

Metafour UK Limited, company number 01528556, is the controller of personal data described in this notice. Our registered office is 2 Berghem Mews, Blythe Road, London W14 0HN.

For privacy questions or to exercise a data-protection right, email privacy@metafour.com. For general service support, email support@metafour.com.

2. Personal data we use

Depending on how you use Pathfindr Pro, we may process:

• account and profile details, such as name, email address, job title, phone number, roles and password-security information;
• workspace and planning information, including company details, depots, vehicles, stops, addresses or postcodes, uploaded coordinates, route settings, planning results and exports;
• billing and transaction information, such as credit purchases, balances, ledger entries, Stripe customer and transaction references, receipts and invoices;
• support and AI-help information, including help conversations, feedback and limited current or recent planning context supplied to answer a question;
• technical and security information, such as IP address, browser and device information, authentication sessions, timestamps, request logs and security events; and
• communication preferences and messages sent to us.

Please avoid putting special-category or highly sensitive personal data into route files or help messages unless it is genuinely necessary and lawful.

3. Where the data comes from

We receive data from you, other authorised users in your shared workspace, your browser or device, and service providers involved in payment, email, postcode lookup, hosting and support. We may derive route plans, usage totals, security indicators and account records from those inputs.

4. Why we use it and our lawful bases

We use personal data:

• to create and manage accounts, provide route planning, save sessions and process credit purchases because it is necessary to perform our contract with you;
• to authenticate users, prevent abuse, secure the service, diagnose faults, maintain records, answer support requests and improve reliability for our legitimate interests in operating a safe and effective service;
• to send essential account, security, payment and service communications to perform our contract or pursue those legitimate interests;
• to send optional marketing communications only where permitted by law, relying on consent where required and always providing a way to opt out;
• to meet tax, accounting, consumer-protection, law-enforcement and other legal obligations;
• to establish, exercise or defend legal claims where necessary; and
• where we specifically ask for consent, for the purpose explained at that time. You may withdraw consent without affecting earlier lawful processing.

We do not rely on consent for strictly necessary authentication cookies or ordinary contractual service processing.

5. Who receives personal data

We use the following sub-processors to process personal data on our behalf:

• Amazon Web Services (AWS) — cloud infrastructure, application hosting, databases, file storage, backups, security and related platform services;
• OpenAI — generation of responses when you choose to use optional AI help, using the question, relevant conversation history and the limited context described in the AI help notice.

AWS and OpenAI process this data under contract and on our instructions for the purposes described above. They do not become owners of your personal data. International transfers involving these sub-processors are handled as described below.

We also disclose only what is reasonably needed to:

• other infrastructure or storage providers used to operate the service;
• payment providers, including Stripe;
• email-delivery and communications providers;
• postcode, mapping and route-computation providers used to create plans;
• HubSpot where it supports account or customer communications;
• professional advisers, auditors, insurers, authorities or courts where necessary; and
• a buyer or reorganised entity if our business or relevant assets are transferred, subject to appropriate safeguards.

Other authorised members of your shared workspace may see workspace data.

We do not sell personal data.

6. International transfers

Some providers or their support teams may process data outside the United Kingdom. Where UK data-protection law requires it, we use an adequacy regulation, the UK International Data Transfer Agreement or UK Addendum, or another lawful safeguard. Contact us for more information about safeguards relevant to your data.

7. How long we keep data

We keep personal data only for as long as reasonably needed for the purpose collected. The period depends on whether an account or planning record remains active, whether information is needed to provide support or preserve security and transaction records, legal limitation periods, and tax, accounting or regulatory requirements.

We may retain minimal records of legal acceptance, payments, refunds, disputes, security events and account history after other service data is removed where needed to demonstrate compliance, resolve a dispute or meet a legal obligation. Backup copies are removed or overwritten through normal backup cycles. We anonymise or delete data when it is no longer needed.

8. Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct or erase personal data; restrict or object to processing; receive portable data; and withdraw consent. These rights are not absolute and lawful exemptions may apply.

Your right to object: where we rely on legitimate interests, you can object to that processing because of your particular situation. You have an absolute right to object to personal data being used for direct marketing.

Email privacy@metafour.com to make a request. We may need to verify your identity. You can also complain to the Information Commissioner’s Office, but we would appreciate the opportunity to address your concern first.

9. Automated decisions and children

Pathfindr Pro creates planning suggestions and may provide AI-generated help, but we do not use those features to make decisions about you that have legal or similarly significant effects. The consumer service is for people aged 18 or over.

10. Changes

We may update this notice as the service, providers or law change. The version and effective date at the top identify the notice currently in force.